---
title: OOM Kill
description: Track process OOM kills by the system or cgroup.
breadcrumbs: Docs > Integrations > OOM Kill
---

# OOM Kill
Supported OS Integration version1.0.0
## Overview{% #overview %}

This check monitors the kernel OOM (out of memory) kill process through the Datadog Agent and the System Probe.

## Setup{% #setup %}

### Installation{% #installation %}

The OOM Kill check is included in the [Datadog Agent](https://app.datadoghq.com/account/settings/agent/latest) package. It relies on an eBPF program implemented in the System Probe.

The eBPF program used by the System Probe is compiled at runtime and requires you to have access to the proper kernel headers.

On Debian-like distributions, install the kernel headers like this:

```sh
apt install -y linux-headers-$(uname -r)
```

On RHEL-like distributions, install the kernel headers like this:

```sh
yum install -y kernel-headers-$(uname -r)
yum install -y kernel-devel-$(uname -r)
```

**Note**: Kernel version 4.9 or later is required for the OOM Kill check to work. In addition, Windows and CentOS/RHEL versions earlier than 8 are not supported.

### Configuration{% #configuration %}

1. In the `system-probe.yaml` file at the root of your Agent's configuration directory, add the following configuration:

   ```yaml
   system_probe_config:
       enable_oom_kill: true
   ```

1. Ensure that the `oom_kill.d/conf.yaml` file is present in the `conf.d/` folder at the root of your Agent's configuration directory to start collecting your OOM Kill metrics. See the [example oom_kill.d/conf.yaml](https://github.com/DataDog/datadog-agent/blob/master/cmd/agent/dist/conf.d/oom_kill.d/conf.yaml.example) for all available configuration options.

1. [Restart the Agent](https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent).

### Configuration with Docker{% #configuration-with-docker %}

In addition to mounting `system-probe.yaml` and `oom_kill.d/conf.yaml` as described above, do the following configuration:

1. Mount the following volumes to the Agent container:

   ```
   -v /sys/kernel/debug:/sys/kernel/debug
   -v /lib/modules:/lib/modules
   -v /usr/src:/usr/src
   ```

1. Add the following permission to enable BPF operations:

   ```
   --privileged
   ```

From kernel version 5.8, the `--privileged` parameter can be replaces by `--cap-add CAP_BPF`.

**Note**: `--privileged` mode is not supported in Docker swarm.

### Configuration with Helm{% #configuration-with-helm %}

With the [Datadog Helm chart](https://github.com/DataDog/helm-charts), ensure that the `datadog.systemProbe` and `datadog.systemProbe.enableOOMKill` parameters are enabled in the `values.yaml` file.

### Configuration with the Operator (v1.0.0+){% #configuration-with-the-operator-v100 %}

Set the `features.oomKill.enabled` parameter in the DatadogAgent manifest:

```yaml
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  features:
    oomKill:
      enabled: true
```

**Note**: When using COS (Container Optimized OS), override the `src` volume in the node Agent:

```yaml
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  features:
    oomKill:
      enabled: true
  override:
    nodeAgent:
      volumes:
      - emptyDir: {}
        name: src
```

### Validation{% #validation %}

[Run the Agent's status subcommand](https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information) and look for `oom_kill` under the Checks section.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

|  |
|  |
| **oom\_kill.oom\_process.count**(count) | The count of processes OOM killed*Shown as process* |

### Service Checks{% #service-checks %}

The OOM Kill check does not include any service checks.

### Events{% #events %}

The OOM Kill check submits an event for each OOM Kill that includes the killed process ID and name, as well as the triggering process ID and name.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).